How to move importer secrets to a secrets file

Since version 2.17, the recordm-importer reads secrets (tokens, passwords) from a dedicated recordm-importer-secrets.properties file, kept next to recordm-importer.properties. Moving the secrets there keeps the main properties file free of sensitive values, so it can stay in cleartext in the repository while only the small secrets file is encrypted.

Pre-requirements

This page assumes you know how a custom importer is configured and have SOPS set up to create encrypted files in the server repository.

1. In the importer's directory, create the secrets file as an encrypted file, as described in How to add, update and remove encrypted files:

   sops <importer-dir>/recordm-importer-secrets.properties.enc

2. Move the secret lines from recordm-importer.properties into it, keeping the same key names — typically recordm.token, datasource.password or http4.authPassword. See the secrets file template for the full list per importer type. When the same key exists in both files, the value in the secrets file wins, so the migration is just moving lines from one file to the other.

3. If any groovy script of the importer (body.groovy, uri.groovy, ...) read one of the moved values from the properties header, change it to use secret(...) instead — secrets are no longer part of that header:

   def pass = secret('datasource.password')

   See Accessing secrets in scripts for the available calls.

4. Commit both changes together and deploy. On startup the importer logs the number and the names of the loaded secrets (values are never logged) — confirm the keys you moved are listed:

   Loaded 2 secret(s) from .../recordm-importer-secrets.properties: [datasource.password, recordm.token]

See also

• Importer properties template — the secrets file template and the secret() scripting API.
• How to add, update and remove encrypted files — encrypting the secrets file and converting the now secret-free main file back to cleartext.
• How to generate an intemporal token — obtaining the recordm.token value.